CVE-2026-47301
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.
Risk Assessment
The organization faces the risk of privilege escalation by an attacker who already has network access, potentially leading to full control over systems managed by Configuration Manager.
Recommendation
Apply the security update provided by Microsoft for Configuration Manager immediately. Additionally, restrict user permissions in the network and monitor for unusual activity.
Other vulnerabilities in Microsoft Configuration Manager
See all- CVE-2026-88075High
SQL injection vulnerability in Microsoft Configuration Manager due to improper neutralization of special elements in SQL commands. An authorized attacker can elevate privileges over a network.
- CVE-2026-70049High
An SQL injection vulnerability exists in Microsoft Configuration Manager. An authorized attacker can exploit this flaw to elevate privileges over an adjacent network.
- CVE-2025-47179Medium
Microsoft Configuration Manager contains improper access control allowing an authorized attacker to elevate privileges locally. The vulnerability requires valid credentials but no user interaction.
- CVE-2025-59501Medium
Authentication bypass by spoofing exists in Microsoft Configuration Manager, allowing an authorized attacker to perform spoofing over an adjacent network. The vulnerability enables an attacker to impersonate a trusted entity.
- CVE-2025-55320Medium
Improper neutralization of special elements used in an SQL command (SQL injection) in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Original NVD description (English source)
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS